Cyber Posture

CVE-2019-25640

HighPublic PoC

Published: 24 March 2026

Published
24 March 2026
Modified
01 May 2026
KEV Added
Patch
CVSS Score 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
EPSS Score 0.0012 29.8th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Inout Article Base CMS contains SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries through the 'p' and 'u' parameters. Attackers can inject SQL code using XOR-based payloads in GET requests to portalLogin.php to extract sensitive database information…

more

or cause denial of service through time-based attacks.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Enforces validation and sanitization of untrusted inputs like the 'p' and 'u' GET parameters in portalLogin.php to directly prevent SQL injection exploitation.

prevent

Requires timely remediation of identified flaws, such as patching CVE-2019-25640 in Inout Article Base CMS to eliminate the SQL injection vulnerability.

prevent

Implements boundary protection mechanisms like web application firewalls to inspect and block malicious SQL injection payloads in network traffic to portalLogin.php.

Security SummaryAI

CVE-2019-25640 is an SQL injection vulnerability (CWE-89) in Inout Article Base CMS, affecting the portalLogin.php component. The flaw arises from insufficient sanitization of the 'p' and 'u' parameters in GET requests, enabling attackers to manipulate database queries with XOR-based payloads. Published on 2026-03-24, it carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high severity due to network accessibility and confidentiality risks.

Unauthenticated remote attackers can exploit this vulnerability by sending crafted GET requests to portalLogin.php. Successful exploitation allows extraction of sensitive database information or denial of service via time-based blind SQL injection techniques, with low attack complexity and no user interaction required.

Advisories and proof-of-concept exploits detail the issue, including an Exploit-DB entry at https://www.exploit-db.com/exploits/46593, the vendor product page at https://www.inoutscripts.com/products/inout-article-base/, and a VulnCheck advisory at https://www.vulncheck.com/advisories/inout-article-base-cms-lastest-sql-injection-via-portallogin-php. Practitioners should consult these for detection signatures, patch availability, or upgrade guidance from the vendor.

Details

CWE(s)

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
Why these techniques?

SQL injection in public-facing web application (portalLogin.php) directly enables exploitation of public-facing application (T1190) and facilitates data collection from databases via query manipulation (T1213.006).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References